Vulnerability Description
decap-server contains a path traversal vulnerability in the local proxy containment guard that uses plain string prefix comparison without path separator validation. Attackers can access sibling directories whose names begin with the repository directory name to read, write, or delete files outside the intended repository root.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/decaporg/decap-cms
- https://github.com/decaporg/decap-cms/blob/11f35405cd1a1d1216e97b890173f46436752
- https://github.com/geo-chen/oss/blob/main/decap-cms.md
- https://www.vulncheck.com/advisories/decap-server-path-traversal-via-sibling-dir
FAQ
What is CVE-2026-92812?
CVE-2026-92812 is a vulnerability with a CVSS score of 6.8 (MEDIUM). decap-server contains a path traversal vulnerability in the local proxy containment guard that uses plain string prefix comparison without path separator validation. Attackers can access sibling direc...
How severe is CVE-2026-92812?
CVE-2026-92812 has been rated MEDIUM with a CVSS base score of 6.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-92812?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.